Web UI, packaging, systemd units, installer scripts, namespace integration tests

React/TS analyser (virtualised packet list, protocol tree, verified hex mapping),
setup wizard, network/devices/health/library/settings pages. Installer with
backup and rollback, uninstall/repair/diagnose. Docker+netns integration suite
covering DHCP, DNS, NAT, isolation, IPv6 blocking, capture and export.

systemd/pilens-dnsmasq.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=PiLens DHCP and DNS for the access-point network
+Documentation=file:/opt/pilens/docs/architecture.md
+After=network.target pilens-helper.service
+ConditionPathExists=/var/lib/pilens-helper/dnsmasq.conf
+
+[Service]
+Type=simple
+# Bound only to the AP interface (interface=/bind-dynamic in the generated config).
+ExecStart=/usr/sbin/dnsmasq --keep-in-foreground --conf-file=/var/lib/pilens-helper/dnsmasq.conf --pid-file
+Restart=on-failure
+RestartSec=2
+ProtectHome=yes
+PrivateTmp=yes
+
+[Install]
+WantedBy=multi-user.target

systemd/pilens-firewall.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=PiLens firewall restore (before networking)
+Documentation=file:/opt/pilens/docs/architecture.md
+DefaultDependencies=no
+After=local-fs.target nftables.service
+Before=network-pre.target NetworkManager.service
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+# Loads only the "inet pilens" table from the last successfully applied configuration.
+ExecStart=/opt/pilens/bin/pilens-helper -boot
+
+[Install]
+WantedBy=multi-user.target

systemd/pilens-helper.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=PiLens privileged network helper
+Documentation=file:/opt/pilens/docs/architecture.md
+After=pilens-firewall.service NetworkManager.service
+Wants=pilens-firewall.service
+
+[Service]
+Type=simple
+ExecStart=/opt/pilens/bin/pilens-helper -socket /run/pilens/helper.sock -user pilens
+Restart=on-failure
+RestartSec=2
+RuntimeDirectory=pilens
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+StateDirectory=pilens-helper
+StateDirectoryMode=0700
+# Sandboxing: root, but limited to what applying network configuration needs.
+ProtectSystem=strict
+ReadWritePaths=/etc/NetworkManager/system-connections /var/lib/pilens-helper /run/pilens /proc/sys/net/ipv4/ip_forward
+ProtectHome=yes
+PrivateTmp=yes
+NoNewPrivileges=yes
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE
+RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+LockPersonality=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target

systemd/pilens.service

@@ -0,0 +1,48 @@
+[Unit]
+Description=PiLens network forensics appliance (web UI, capture engine)
+Documentation=file:/opt/pilens/docs/architecture.md
+After=network-online.target pilens-helper.service
+Wants=network-online.target pilens-helper.service
+StartLimitIntervalSec=300
+StartLimitBurst=10
+
+[Service]
+Type=notify
+User=pilens
+Group=pilens
+SupplementaryGroups=wireshark
+ExecStart=/opt/pilens/bin/pilens serve -data /var/lib/pilens -listen :8443
+Restart=on-failure
+RestartSec=3
+WatchdogSec=60
+# Shutdown stops any running capture and hashes its last segment.
+TimeoutStopSec=60
+KillSignal=SIGTERM
+StateDirectory=pilens
+StateDirectoryMode=0750
+UMask=0027
+# dumpcap gains cap_net_raw/cap_net_admin from its file capabilities, which do
+# not work under NoNewPrivileges. The bounding set caps what any child can gain.
+CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN
+AmbientCapabilities=
+ProtectSystem=strict
+ReadWritePaths=/var/lib/pilens
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=no
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK AF_PACKET
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target